@coderook/cli 0.36.0 → 0.37.0

package/dist/cli/src/cli.js

@@ -32,7 +32,12 @@ const build_command_js_1 = require("./build_command.js");
 const node_check_js_1 = require("./node_check.js");
 const pages_command_js_1 = require("./pages_command.js");
 const mods_command_js_1 = require("./mods_command.js");
-const github_bridge_js_1 = require("./github_bridge.js");
+const private_command_js_1 = require("./private_command.js");
+const actions_command_js_1 = require("./actions_command.js");
+const issue_command_js_1 = require("./issue_command.js");
+const verify_command_js_1 = require("./verify_command.js");
+const community_command_js_1 = require("./community_command.js");
+const pr_command_js_1 = require("./pr_command.js");
 const project_commands_js_1 = require("./project_commands.js");
 const track_commands_js_1 = require("./track_commands.js");
 const tracks_js_1 = require("../../cbx/src/core/tracks.js");
@@ -2795,33 +2800,29 @@ const SPECS = [
         run: pages_command_js_1.commandPages,
     },
     {
-        name: "github",
+        name: "private",
         group: "Your projects",
-        summary: "review and test proposals with GitHub tools (CodeRabbit, Blacksmith, Actions)",
-        usage: "github <setup|sync> …",
-        detail: "Mirrors a project's open proposals to pull requests in a GitHub repository,\n" +
-            "so tools that only connect to GitHub review and build them, and reports\n" +
-            "what they conclude back to each proposal as checks. A required check that\n" +
-            "fails stops the proposal being applied, like any other check.\n\n" +
-            "It runs on GitHub, in a workflow setup writes into the project. CodeRook\n" +
-            "never holds a GitHub credential; GitHub holds a CodeRook token that reaches\n" +
-            "this project only and can read it and report checks, nothing else.\n\n" +
-            "  setup <owner>/<repo> [folder]   make the token, write the workflow\n" +
-            "  sync [--repo <owner>/<repo>]    mirror and report once (what the workflow runs)\n\n" +
-            "Use a GitHub repository nothing else pushes to: the mirror only moves\n" +
-            "forward, and a branch changed on GitHub is left alone and reported.",
+        summary: "files and folders only the project's own people may see",
+        usage: "private [list|add|remove|set] [pattern…] [--project <project>]",
+        detail: "Keeps chosen files out of sight in a public project: visitors, the\n" +
+            "public API, git clone, zips, Pages and search leave them out, while\n" +
+            "members see everything. Patterns work like a .gitignore:\n\n" +
+            "  design/          a folder of that name, anywhere\n" +
+            "  *.psd            every file of a type\n" +
+            "  docs/internal    a path from the top of the project\n" +
+            "  src/**/*.key     any depth in between\n\n" +
+            "The list is kept on the project, not in a file, so it covers every\n" +
+            "version at once, old ones included, and a save cannot undo it. Only the\n" +
+            "project's owner or an admin can change it.",
         options: [
-            { flags: "--repo <owner/repo>", description: "sync: the GitHub repository (default: the one the workflow runs in)" },
-            { flags: "--project <slug>", description: "sync: the CodeRook project (default: this folder's)" },
-            { flags: "--required <names>", description: "checks that must pass, e.g. \"github/build,review/coderabbitai[bot]\"" },
-            { flags: "--force", description: "setup: write the workflow again" },
+            { flags: "--project <project>", description: "a project other than this folder's" },
         ],
         examples: [
-            "cbx github setup my-name/my-game-mirror",
-            "cbx submit",
-            "cbx github sync --repo my-name/my-game-mirror",
+            'cbx private add "design/" "*.psd"',
+            "cbx private list",
+            'cbx private remove "*.psd"',
         ],
-        run: github_bridge_js_1.commandGithub,
+        run: private_command_js_1.commandPrivate,
     },
     {
         name: "mods",
@@ -2911,6 +2912,34 @@ const SPECS = [
         ],
         run: service_commands_js_1.commandIssues,
     },
+    {
+        name: "issue",
+        group: "Your projects",
+        summary: "read, answer, close, label or assign one issue",
+        usage: "issue view|comment|close|reopen|label|assign <number> … | issue labels | issue rules",
+        detail: "Closing says why: completed (the default), --reason not-planned, or\n" +
+            "--duplicate-of <n>. Labels and assignment need write access; replying\n" +
+            "needs only read access, as on the website.\n\n" +
+            "Inside a run, CODEROOK_TOKEN and CODEROOK_PROJECT are set, so a workflow\n" +
+            "can comment on or label the issue that started it with no setup.",
+        options: [
+            { flags: "-m, --message <text>", description: "what to say (comment, or a note when closing)" },
+            { flags: "--reason <completed|not-planned>", description: "why it is closed" },
+            { flags: "--duplicate-of <n>", description: "close as a duplicate of another issue" },
+            { flags: "--remove", description: "take the labels off instead" },
+            { flags: "--starter", description: "with labels: add the usual set" },
+            { flags: "--project <name>", description: "which project" },
+        ],
+        examples: [
+            "cbx issue view 12",
+            'cbx issue comment 12 -m "Fixed in v41"',
+            "cbx issue close 12 --duplicate-of 9",
+            "cbx issue label 12 bug,ui",
+            "cbx issue assign 12 sam",
+            "cbx issue labels --starter",
+        ],
+        run: issue_command_js_1.commandIssue,
+    },
     {
         name: "releases",
         aliases: ["tags"],
@@ -2939,7 +2968,9 @@ const SPECS = [
             "The signing secret is generated by the service and shown once, when\n" +
             "the hook is added — no route hands it back afterwards.\n\n" +
             "Events: version.published, merge.opened, merge.applied, merge.cancelled,\n" +
-            "check.reported, change_request.opened, change_request.reviewed.\n" +
+            "check.reported, change_request.opened, change_request.reviewed,\n" +
+            "issue.opened, issue.closed, issue.reopened, issue.commented,\n" +
+            "issue.labeled, run.finished, run.failed, release.published.\n" +
             "Naming none of them sends all of them.",
         options: [
             { flags: "--add <url>", description: "notify this address; https only" },
@@ -3189,16 +3220,96 @@ const SPECS = [
         options: [
             { flags: "--version <n>", description: "name this version instead of the newest" },
             { flags: "--notes <text>", description: "what changed, for the release page" },
+            { flags: "--generate-notes", description: "write the notes from what changed since the last release" },
+            { flags: "--draft", description: "save it as a draft: nothing is public until cbx release publish" },
+            { flags: "--prerelease", description: "keep it off the default update feed" },
+            { flags: "--channel <name>", description: "the update channel, like beta or nightly (stable by default)" },
             { flags: "--downloads <public|private>", description: "who can take what is attached, apart from the source" },
         ],
         examples: [
             "cbx release v1.0",
+            "cbx release v2.0 --draft --generate-notes",
+            "cbx release publish --version 41",
+            "cbx release v2.1.0-beta.1 --prerelease --channel beta",
             'cbx release v1.2 --version 41 --notes "Fixes the export dialog"',
             "cbx release 1.4.0 --downloads public",
             "cbx release --downloads private --version 41",
         ],
         run: service_commands_js_1.commandRelease,
     },
+    {
+        name: "fork",
+        group: "Your projects",
+        summary: "your own copy of somebody's project, and offering work back",
+        usage: "fork <owner/project> [--name <slug>] | fork offer [line] --title <text> | fork sync",
+        detail: "A fork is a private project under your account with the original's latest\n" +
+            "public version (its private files left out). Nothing is uploaded again.\n\n" +
+            "Inside a fork, `cbx fork offer <line>` offers that line to the original as\n" +
+            "a pull request (offered again, the same pull request moves to your newest\n" +
+            "save). Its runs there wait for the project's approval and get none of its\n" +
+            "secrets. `cbx fork sync` brings the original's latest into an `upstream`\n" +
+            "line of your fork, to merge when you choose.",
+        options: [
+            { flags: "--name <slug>", description: "what to call your copy" },
+            { flags: "--title <text>", description: "offer: the pull request's title" },
+            { flags: "--body <text>", description: "offer: its description" },
+            { flags: "--project <name>", description: "offer/sync: which fork" },
+        ],
+        examples: ["cbx fork sam/editor", 'cbx fork offer fix-export --title "Fix the export dialog"', "cbx fork sync"],
+        run: community_command_js_1.commandFork,
+    },
+    {
+        name: "security",
+        group: "Your projects",
+        summary: "report a vulnerability privately, or handle reports",
+        usage: "security report <owner/project> --title <text> | security list | view|reply|mark S-<n>",
+        detail: "A report is seen only by the project's owner and admins, and by whoever\n" +
+            "sent it. Please use this rather than a public issue for anything that\n" +
+            "could hurt people using the project.",
+        options: [
+            { flags: "--title <text>", description: "report: what is wrong" },
+            { flags: "--body <text>", description: "report: details and how to reproduce it" },
+            { flags: "--severity <level>", description: "report: low, medium, high or critical" },
+            { flags: "-m, --message <text>", description: "reply: what to say" },
+            { flags: "--project <name>", description: "list/view/reply/mark: which project" },
+        ],
+        examples: [
+            'cbx security report sam/editor --title "Path traversal in export" --severity high',
+            "cbx security list",
+            'cbx security reply S-3 -m "Confirmed; fix in 2.0.1"',
+            "cbx security mark S-3 fixed",
+        ],
+        run: community_command_js_1.commandSecurity,
+    },
+    {
+        name: "verify",
+        group: "Your projects",
+        summary: "check a download against its release's signed manifest",
+        usage: "verify <owner/project> <release> <file…>",
+        detail: "Every public release has a manifest listing each file with its size and\n" +
+            "SHA-256, signed with CodeRook's release key. This checks the signature,\n" +
+            "then the files you downloaded. A mismatch means do not run it.",
+        options: [{ flags: "--key <base64>", description: "pin the release key instead of the one cbx knows" }],
+        examples: ["cbx verify sam/editor v2.0.0 ./editor-setup.exe"],
+        run: verify_command_js_1.commandVerify,
+    },
+    {
+        name: "deps",
+        group: "Your projects",
+        summary: "known vulnerabilities in a save's dependencies",
+        usage: "deps [version]",
+        detail: "Reads the lockfiles in the save (package-lock.json, yarn.lock,\n" +
+            "requirements.txt, poetry.lock, Pipfile.lock, Cargo.lock, go.sum,\n" +
+            "composer.lock, Gemfile.lock) and asks OSV about every pinned version.\n" +
+            "Only names and versions are sent, never code. Pull requests carry the\n" +
+            "same answer as the coderook/dependencies check.",
+        options: [
+            { flags: "--fresh", description: "ask OSV again rather than reading the kept report" },
+            { flags: "--project <name>", description: "which project" },
+        ],
+        examples: ["cbx deps", "cbx deps 41 --fresh"],
+        run: verify_command_js_1.commandDeps,
+    },
     {
         name: "actions",
         aliases: ["workflows"],
@@ -3211,7 +3322,10 @@ const SPECS = [
             "ran against, so a passing build becomes a download without anybody\n" +
             "opening the website. --ship turns that on for one action.\n\n" +
             "Attaching is publishing: what an action ships onto a public version\n" +
-            "is a download anybody can take, from the moment the run passes.",
+            "is a download anybody can take, from the moment the run passes.\n\n" +
+            "cbx actions check [files…] checks workflow files (.rook/workflows)\n" +
+            "before you save them. cbx actions set <action> changes one made on the\n" +
+            "website: --schedule, --timeout, --approval, --concurrency.",
         options: [
             { flags: "--ship <action>", description: "its builds become downloads on the version" },
             { flags: "--no-ship <action>", description: "keep its files without attaching them" },
@@ -3219,15 +3333,123 @@ const SPECS = [
             { flags: "--on-proposal <action>", description: "run it on proposals; its result becomes a check" },
             { flags: "--by-hand <action>", description: "run it only when somebody starts it" },
             { flags: "--project <name>", description: "which project" },
+            { flags: "--schedule <cron>", description: "with set: run it on a schedule (UTC); off to stop" },
+            { flags: "--timeout <minutes>", description: "with set: stop a run that takes longer; off to stop" },
+            { flags: "--approval <on|off>", description: "with set: each run waits for somebody to approve it" },
+            { flags: "--concurrency <group>", description: "with set: one run of the group at a time; off to stop" },
+            { flags: "--cancel-old", description: "with set: a new run cancels the group's older ones" },
+            { flags: "--keep-old", description: "with set: a new run waits its turn" },
         ],
         examples: [
             "cbx actions",
+            "cbx actions check",
+            'cbx actions set "Nightly" --schedule "0 3 * * *" --timeout 30',
+            'cbx actions set Deploy --approval on --concurrency deploy --cancel-old',
             'cbx actions --ship "Windows installer"',
             'cbx actions --no-ship "Windows installer"',
             'cbx actions --on-proposal Tests',
         ],
         run: service_commands_js_1.commandWorkflows,
     },
+    {
+        name: "pr",
+        group: "Working with a folder",
+        summary: "pull requests: list, read, review, comment, merge",
+        usage: "pr <list|view|files|comment|approve|request-changes|ask|label|title|ready|draft|retarget|close|reopen|merge> [M-3] …",
+        detail: "A pull request is a line offered to another line (cbx propose opens one).\n" +
+            "This is the Pull requests tab of the website, from here:\n\n" +
+            "  list [--all|--state merged] [--mine] [--label bug]   the project's pull requests\n" +
+            "  view M-3                       description, reviews, checks, conversation, blockers\n" +
+            "  files M-3                      what it changes\n" +
+            "  comment M-3 -m \"…\" [--line path:12]   a comment, or one on a line\n" +
+            "  approve M-3 [-m \"…\"]           approve it\n" +
+            "  request-changes M-3 -m \"…\"     ask for changes\n" +
+            "  ask M-3 sam,priya              ask people to review it\n" +
+            "  label M-3 bug,ui               set its labels\n" +
+            "  title M-3 \"New title\"          rename it\n" +
+            "  ready M-3 | draft M-3          ready for review, or back to draft\n" +
+            "  retarget M-3 release           land it on another line\n" +
+            "  close M-3 | reopen M-3         close without merging, or reopen\n" +
+            "  merge M-3                      merge it, once nothing stands in the way\n\n" +
+            "An approval stops counting when new saves land on the line: it was of the\n" +
+            "code somebody looked at. A draft cannot be merged until it is marked ready.",
+        options: [
+            { flags: "-m, --message <text>", description: "comment, review or title text" },
+            { flags: "--line <path:line>", description: "comment: on this line of a changed file" },
+            { flags: "--project <project>", description: "a project other than this folder's" },
+            { flags: "--state <state>", description: "list: open, merged, closed or all" },
+            { flags: "--label <name>", description: "list: only those with this label" },
+            { flags: "--author <username>", description: "list: only those opened by this person" },
+            { flags: "--all", description: "list: every state" },
+            { flags: "--mine", description: "list: only those waiting on your review" },
+            { flags: "--squash", description: "merge / auto-merge: land as one save, without the line's own saves" },
+            { flags: "--off", description: "auto-merge: stop waiting to merge by itself" },
+        ],
+        examples: [
+            "cbx pr list",
+            "cbx pr view M-3",
+            'cbx pr comment M-3 --line src/app.ts:42 -m "This can be null"',
+            "cbx pr approve M-3",
+            "cbx pr merge M-3",
+            "cbx pr merge M-3 --squash",
+            "cbx pr auto-merge M-3",
+        ],
+        run: pr_command_js_1.commandPr,
+    },
+    {
+        name: "cancel",
+        group: "Actions",
+        summary: "stop a run that is waiting or working",
+        usage: "cancel <number> [project]",
+        detail: "Marks the run cancelled at once. A runner working on it is told at its next\n" +
+            "heartbeat and stops the work, including anything the command started.",
+        examples: ["cbx cancel 12"],
+        run: service_commands_js_1.commandCancel,
+    },
+    {
+        name: "rerun",
+        group: "Actions",
+        summary: "run a finished run again",
+        usage: "rerun <number> [project]",
+        detail: "Queues the same action against the same save. When the run was checking a\n" +
+            "pull request that is still open, its check goes back to waiting.",
+        examples: ["cbx rerun 12"],
+        run: service_commands_js_1.commandRerun,
+    },
+    {
+        name: "approve",
+        group: "Actions",
+        summary: "let a run that waits for approval start",
+        usage: "approve <number> [project]",
+        detail: "An action marked as needing approval (often one that publishes) waits\n" +
+            "after it is set off until somebody who can change the project approves it.",
+        examples: ["cbx approve 12"],
+        run: actions_command_js_1.commandApprove,
+    },
+    {
+        name: "secret",
+        aliases: ["secrets"],
+        group: "Actions",
+        summary: "values runs need that must not be in the files",
+        usage: "secret list | set <NAME> | remove <NAME>",
+        detail: "A secret is handed to each run as an environment variable of the same\n" +
+            "name, but only to runs started by people who can change the project.\n" +
+            "Run logs show *** in its place. Its value is never shown again.\n\n" +
+            "The value is read from what is piped in, from another variable with\n" +
+            "--from-env, or typed at a hidden prompt; never from an argument, which\n" +
+            "would stay in your shell history.",
+        options: [
+            { flags: "--from-env <VAR>", description: "take the value from this environment variable" },
+            { flags: "--project <name>", description: "which project" },
+        ],
+        examples: [
+            "cbx secret list",
+            "cbx secret set DEPLOY_TOKEN",
+            "cbx secret set SIGNING_KEY < key.pem",
+            "cbx secret remove DEPLOY_TOKEN",
+        ],
+        run: actions_command_js_1.commandSecret,
+    },
     {
         name: "runs",
         group: "Actions",
@@ -3254,6 +3476,7 @@ const SPECS = [
             "stderr is shown in red. Exits 1 when the run failed, so this can be\n" +
             "the last line of a script.",
         examples: ["cbx logs 12", "cbx logs #12 my-project"],
+        options: [{ flags: "--follow", description: "keep printing as it runs, until it ends" }],
         run: service_commands_js_1.commandLogs,
     },
     {
@@ -3511,6 +3734,7 @@ SPECS.push({
         "a command of your own, describe the build in coderook.build.json\n" +
         "(cbx build init writes one), which is saved with the project.",
     options: [
+        { flags: "--docker", description: "allow a Docker container as a last resort (never used otherwise)" },
         { flags: "-t, --target <list>", description: "windows-x64, linux-arm64, macos-arm64 … or win, linux, mac, all" },
         { flags: "--plan", description: "say how each target would be built, build nothing" },
         { flags: "--preset <name>", description: "go, bun, deno, rust, dotnet, electron, pyinstaller, python or custom" },

package/dist/cli/src/community_command.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandFork = commandFork;
+exports.commandSecurity = commandSecurity;
+/**
+ * `cbx fork`     — your own copy of somebody's project, and offering work back.
+ * `cbx security` — private vulnerability reports.
+ *
+ *   cbx fork sam/editor [--name my-editor]      copy it into your account
+ *   cbx fork offer [line] --title "…"           offer this fork's line to the original as a pull request
+ *   cbx fork sync                               bring the original's latest into the "upstream" line
+ *
+ *   cbx security report sam/editor --title "…" [--severity high] [--body "…"]
+ *   cbx security list | view S-3 | reply S-3 -m "…" | mark S-3 fixed
+ */
+const api_js_1 = require("./api.js");
+const colour_js_1 = require("./colour.js");
+const project_commands_js_1 = require("./project_commands.js");
+function flagText(parsed, ...names) {
+    for (const name of names) {
+        const value = parsed.flags.get(name);
+        if (typeof value === "string")
+            return value;
+    }
+    return undefined;
+}
+async function commandFork(parsed) {
+    const sub = parsed.positional[0] ?? "";
+    if (sub === "offer" || sub === "sync") {
+        const project = await (0, project_commands_js_1.resolveProject)(flagText(parsed, "project"));
+        if (!project)
+            return 1;
+        if (sub === "sync") {
+            const result = await (0, api_js_1.callApi)(`/v1/repositories/${encodeURIComponent(project.id)}/sync-upstream`, { method: "POST" });
+            console.log(`${(0, colour_js_1.green)("Brought in.")} The original's latest is v${result.sequence} on the ${(0, colour_js_1.accent)("upstream")} line.`);
+            console.log((0, colour_js_1.dim)("  Merge it into yours when you are ready: cbx propose upstream, or on the website."));
+            return 0;
+        }
+        const line = parsed.positional[1] ?? "main";
+        const result = await (0, api_js_1.callApi)(`/v1/repositories/${encodeURIComponent(project.id)}/upstream-pulls`, { method: "POST", body: { line, title: flagText(parsed, "title", "m", "message") ?? `Changes from ${line}`, body: flagText(parsed, "body") ?? null } });
+        console.log(result.updated
+            ? `${(0, colour_js_1.green)("Updated")} ${result.pull.reference} with your newest save on ${line}.`
+            : `${(0, colour_js_1.green)("Opened")} ${result.pull.reference} on the original, from ${result.line}.`);
+        console.log((0, colour_js_1.dim)("  Its runs there wait for the project's approval and get none of its secrets."));
+        return 0;
+    }
+    const reference = sub;
+    if (!reference || !reference.includes("/")) {
+        console.error((0, colour_js_1.red)("Whose project? Try: cbx fork sam/editor   (or: cbx fork offer, cbx fork sync)"));
+        return 1;
+    }
+    const source = await (0, api_js_1.findProject)(reference);
+    if (!source) {
+        console.error((0, colour_js_1.red)(`No project ${reference} that you can see.`));
+        return 1;
+    }
+    const fork = await (0, api_js_1.callApi)(`/v1/repositories/${encodeURIComponent(source.id)}/fork`, {
+        method: "POST",
+        body: flagText(parsed, "name") ? { slug: flagText(parsed, "name") } : {},
+    });
+    console.log(`${(0, colour_js_1.green)("Forked")} ${reference} as ${(0, colour_js_1.bold)(fork.slug)} (private, v${fork.sequence}).`);
+    console.log((0, colour_js_1.dim)(`  Get it: cbx get ${fork.slug}   Offer changes back: cbx fork offer <line> --title "…"`));
+    return 0;
+}
+async function commandSecurity(parsed) {
+    const sub = parsed.positional[0] ?? "list";
+    if (sub === "report") {
+        const reference = parsed.positional[1];
+        const target = reference ? await (0, api_js_1.findProject)(reference) : await (0, project_commands_js_1.resolveProject)(flagText(parsed, "project"));
+        if (!target) {
+            console.error((0, colour_js_1.red)(reference ? `No project ${reference} that you can see.` : "Which project? cbx security report sam/editor --title \"…\""));
+            return 1;
+        }
+        const title = flagText(parsed, "title", "m", "message");
+        if (!title) {
+            console.error((0, colour_js_1.red)('Say what is wrong: --title "Path traversal in export"'));
+            return 1;
+        }
+        const created = await (0, api_js_1.callApi)(`/v1/repositories/${encodeURIComponent(target.id)}/security-reports`, {
+            method: "POST",
+            body: { title, body: flagText(parsed, "body") ?? "", severity: flagText(parsed, "severity") ?? "unknown" },
+        });
+        console.log(`${(0, colour_js_1.green)("Sent privately")} as S-${created.number}. Only the project's owner and admins can read it; you hear when they reply.`);
+        return 0;
+    }
+    const project = await (0, project_commands_js_1.resolveProject)(flagText(parsed, "project"));
+    if (!project)
+        return 1;
+    const base = `/v1/repositories/${encodeURIComponent(project.id)}/security-reports`;
+    if (sub === "list") {
+        const { reports } = await (0, api_js_1.callApi)(base);
+        if (!reports.length) {
+            console.log((0, colour_js_1.dim)(`No security reports on ${project.slug} that you can see.`));
+            return 0;
+        }
+        for (const report of reports) {
+            console.log(`  ${(0, colour_js_1.accent)(`S-${report.number}`)} ${report.title} ${(0, colour_js_1.dim)(`${report.severity} · ${report.state} · ${report.reporter ?? "?"}`)}`);
+        }
+        return 0;
+    }
+    const number = Number((parsed.positional[1] ?? "").replace(/^S-/i, ""));
+    if (!Number.isInteger(number) || number < 1) {
+        console.error((0, colour_js_1.red)(`Which report? cbx security ${sub} S-3`));
+        return 1;
+    }
+    if (sub === "view") {
+        const report = await (0, api_js_1.callApi)(`${base}/${number}`);
+        console.log(`${(0, colour_js_1.bold)(`S-${report.number} ${report.title}`)} ${(0, colour_js_1.dim)(`${report.severity} · ${report.state} · from ${report.reporter ?? "?"}`)}`);
+        console.log(report.body || (0, colour_js_1.dim)("(no details)"));
+        for (const comment of report.comments)
+            console.log(`\n${(0, colour_js_1.accent)(comment.author ?? "Somebody")} ${(0, colour_js_1.dim)(new Date(comment.createdAt).toLocaleString())}\n${comment.body}`);
+        return 0;
+    }
+    if (sub === "reply") {
+        const body = flagText(parsed, "m", "message");
+        if (!body) {
+            console.error((0, colour_js_1.red)('Say something: cbx security reply S-3 -m "Confirmed, fixing"'));
+            return 1;
+        }
+        await (0, api_js_1.callApi)(`${base}/${number}/comments`, { method: "POST", body: { body } });
+        console.log((0, colour_js_1.green)(`Replied on S-${number}.`));
+        return 0;
+    }
+    if (sub === "mark") {
+        const state = parsed.positional[2];
+        if (!state || !["open", "accepted", "fixed", "declined"].includes(state)) {
+            console.error((0, colour_js_1.red)("Mark it open, accepted, fixed or declined: cbx security mark S-3 fixed"));
+            return 1;
+        }
+        await (0, api_js_1.callApi)(`${base}/${number}`, { method: "PATCH", body: { state } });
+        console.log((0, colour_js_1.green)(`S-${number} is ${state}. Whoever reported it is told.`));
+        return 0;
+    }
+    console.error((0, colour_js_1.red)(`cbx security has no "${sub}". `) + "Try: report, list, view, reply, mark");
+    return 1;
+}

package/dist/cli/src/config.js

@@ -32,7 +32,8 @@ const node_os_1 = require("node:os");
 const node_path_1 = __importDefault(require("node:path"));
 exports.DEFAULT_API = "https://api.coderook.com";
 function apiOrigin() {
-    return (process.env.CODEROOK_API_URL || exports.DEFAULT_API).replace(/\/+$/, "");
+    /* CODEROOK_API is what a run is handed (with CODEROOK_TOKEN), so cbx inside a run needs no setup. */
+    return (process.env.CODEROOK_API_URL || process.env.CODEROOK_API || exports.DEFAULT_API).replace(/\/+$/, "");
 }
 /**
  * The website that goes with the service, for a link somebody can open.